VulnerabilityDeferred

CVE-2026-60081

An unbounded value allows an attacker to specify a large index and consume available memory.

HIGH 7.5EPSS 0.36%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.36% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-770
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

References

https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch
https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4
https://metacpan.org/release/HMBRAND/DBI-1.651/changes
http://www.openwall.com/lists/oss-security/2026/07/14/14

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.